Sandworm-linked threat actors are using fake job interviews to trick IT professionals into installing a trojanized WireGuard VPN client.
Ukraine’s CERT-UA attributes the activity to UAC-0145, a subcluster of UAC-0002, also known as Sandworm, APT44, and Seashell Blizzard.
The campaign has reportedly been active since at least May 2026 and primarily targets system administrators and other technical staff.
The operation stands out because it combines a realistic recruitment process with a modified version of a trusted VPN tool.
Instead of relying on a simple phishing email, the attackers study candidates’ resumes on job-search platforms and build credibility over several steps.
Victims are contacted by people claiming to represent IT companies, including ATLAS Business Group. Initial contact takes place through a job platform’s chat feature before moving to Telegram.
There, a fake HR representative discusses the role, work format, and English-language skills. Candidates are then invited to a Zoom interview, which is reportedly attended by a real person speaking English.
The attackers later send technical-assessment instructions by email. In one observed case, the sender impersonated Sopra Steria Bulgaria using the spoofed domain soprasteria-bg[.]com, which resembles legitimate Sopra Steria domains but is not associated with the company.
The email includes WireGuard configuration files for a supposed corporate VPN and another Zoom link to supervise the technical task.
Sandworm Targets IT Professionals
The provided VPN configuration is designed to fail. When candidates report connection errors, the fake recruiter recommends downloading a custom VPN client called SopraVPN from SourceForge.
The download link is presented through the spoofed corporate website, making the software appear legitimate. SopraVPN is compiled from WireGuard source code but contains malicious changes.
The most important addition is a non-standard configuration field named SymmetricKey. This field holds Base64-encoded AES-256-GCM encrypted data, including a nonce, ciphertext, and authentication tag.
The malware derives the AES key from the decoded PrivateKey value in the VPN configuration.
It then decrypts embedded PowerShell code and passes it to WireGuard’s normal runScriptCommand mechanism, commonly used to process configuration directives such as PostUp.
This allows the modified client to run attacker-controlled commands while appearing to perform a normal VPN connection.
The attackers also changed the way the VPN client handles Base64 key data. Instead of standard Base64, the PrivateKey and PublicKey fields use a custom alphabet generated through a Fisher-Yates shuffle.
The shuffle uses a CRC32 value calculated from SymmetricKey as a seed. This design makes the configuration harder to inspect and prevents ordinary Base64 decoders from revealing the key material or payload logic, CERT said.
On Windows, the decrypted PowerShell command creates a scheduled task named \Microsoft\Windows\ApplicationData\Microsoft.
That task downloads an additional payload from an attacker-controlled URL. On Linux, the malware checks for cURL, installs it if necessary, and downloads an executable to /usr/libexec/timesyncd-check through the malicious VPN infrastructure.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
